<!DOCTYPE html>
<html lang="zh-CN">
<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <meta name="keywords" content="Hexo Theme Redefine">
    
    <meta name="author" content="xiaoeryu">
    <!-- preconnect -->
    <link rel="preconnect" href="https://fonts.googleapis.com">
    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>

    
    <!--- Seo Part-->
    
    <link rel="canonical" href="https://xiaoeeyu.github.io/2024/08/09/绕过爱奇艺libmsaoaidsec-so的frida检测/"/>
    <meta name="robots" content="index,follow">
    <meta name="googlebot" content="index,follow">
    <meta name="revisit-after" content="1 days">
    
    
    
        
        <meta name="description" content="本文中所有内容仅供研究与学习使用，请勿用于任何商业用途和非法用途，否则后果自负！ 下面主要分析了如何定位Frida检测位置，以及定位后如何绕过的问题。其原理参见之前写的libcHook 0x00：环境设备：Google Pixel 5 系统版本：Android 13 版本号：TQ2A.230405.003.B2 Frida-Server：16.2.1 爱奇艺：15.7.5 0x01：问题爱奇艺有反">
<meta property="og:type" content="article">
<meta property="og:title" content="绕过爱奇艺libmsaoaidsec.so的Frida检测">
<meta property="og:url" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/index.html">
<meta property="og:site_name" content="xiaoeryu">
<meta property="og:description" content="本文中所有内容仅供研究与学习使用，请勿用于任何商业用途和非法用途，否则后果自负！ 下面主要分析了如何定位Frida检测位置，以及定位后如何绕过的问题。其原理参见之前写的libcHook 0x00：环境设备：Google Pixel 5 系统版本：Android 13 版本号：TQ2A.230405.003.B2 Frida-Server：16.2.1 爱奇艺：15.7.5 0x01：问题爱奇艺有反">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807181833519.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807185049751.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807214508434.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807220025518.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807223922777.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807230428971.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807232702784.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807233048464.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807233934309.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807233856368.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807235012797.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240811173455755.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240811180103387.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240811181118140.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240811212738608.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240811213558416.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240811214336838.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240811214529666.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240811215233683.png">
<meta property="article:published_time" content="2024-08-09T03:29:58.000Z">
<meta property="article:modified_time" content="2024-08-11T15:42:36.213Z">
<meta property="article:author" content="xiaoeryu">
<meta property="article:tag" content="App逆向">
<meta property="article:tag" content="Frida反调试">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="https://xiaoeeyu.github.io/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807181833519.png">
    
    
    <!--- Icon Part-->
    <link rel="icon" type="image/png" href="/images/rabete.jpg" sizes="192x192">
    <link rel="apple-touch-icon" sizes="180x180" href="/images/rabete.jpg">
    <meta name="theme-color" content="#A31F34">
    <link rel="shortcut icon" href="/images/rabete.jpg">
    <!--- Page Info-->
    
    <title>
        
            绕过爱奇艺libmsaoaidsec.so的Frida检测 | xiaoeryu
        
    </title>

    
<link rel="stylesheet" href="/fonts/Chillax/chillax.css">


    <!--- Inject Part-->
    

    
<link rel="stylesheet" href="/css/style.css">


    
        
<link rel="stylesheet" href="/css/build/tailwind.css">

    

    
<link rel="stylesheet" href="/fonts/GeistMono/geist-mono.css">

    
<link rel="stylesheet" href="/fonts/Geist/geist.css">

    <!--- Font Part-->
    
    
    
    
    
    

    <script id="hexo-configurations">
    window.config = {"hostname":"xiaoeeyu.github.io","root":"/","language":"zh-CN","path":"search.xml"};
    window.theme = {"articles":{"style":{"font_size":"16px","line_height":1.5,"image_border_radius":"14px","image_alignment":"center","image_caption":false,"link_icon":true,"delete_mask":false,"title_alignment":"left","headings_top_spacing":{"h1":"3.2rem","h2":"2.4rem","h3":"1.9rem","h4":"1.6rem","h5":"1.4rem","h6":"1.3rem"}},"word_count":{"enable":true,"count":true,"min2read":true},"author_label":{"enable":true,"auto":false,"list":[]},"code_block":{"copy":true,"style":"mac","highlight_theme":{"light":"github","dark":"vs2015"},"font":{"enable":false,"family":null,"url":null}},"toc":{"enable":true,"max_depth":4,"number":false,"expand":true,"init_open":true},"copyright":{"enable":true,"default":"cc_by_nc_sa"},"lazyload":true,"pangu_js":false,"recommendation":{"enable":false,"title":"推荐阅读","limit":3,"mobile_limit":2,"placeholder":"/images/ball-0101.jpg","skip_dirs":[]}},"colors":{"primary":"#A31F34","secondary":null,"default_mode":"light"},"global":{"fonts":{"chinese":{"enable":false,"family":null,"url":null},"english":{"enable":false,"family":null,"url":null},"title":{"enable":false,"family":null,"url":null}},"content_max_width":"1000px","sidebar_width":"210px","hover":{"shadow":true,"scale":false},"scroll_progress":{"bar":false,"percentage":true},"website_counter":{"url":"https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js","enable":true,"site_pv":true,"site_uv":true,"post_pv":true},"single_page":true,"preloader":{"enable":false,"custom_message":null},"open_graph":true,"google_analytics":{"enable":false,"id":null}},"home_banner":{"enable":true,"style":"fixed","image":{"light":"/images/wallhaven-jxl31y.png","dark":"/images/wallhaven-o5762l.png"},"title":"XIAOERYU","subtitle":{"text":["明心见性，拨云见日","Don't wait, to create"],"hitokoto":{"enable":false,"show_author":false,"api":"https://v1.hitokoto.cn"},"typing_speed":100,"backing_speed":80,"starting_delay":500,"backing_delay":1500,"loop":true,"smart_backspace":true},"text_color":{"light":"#fff","dark":"#d1d1b6"},"text_style":{"title_size":"2.8rem","subtitle_size":"1.5rem","line_height":1.2},"custom_font":{"enable":false,"family":null,"url":null},"social_links":{"enable":true,"style":"default","links":{"github":"https://github.com/xiaoeeyu","instagram":null,"zhihu":null,"twitter":null,"email":"xiaoeryu@163.com"},"qrs":{"weixin":null}}},"plugins":{"feed":{"enable":false},"aplayer":{"enable":false,"type":"fixed","audios":[{"name":null,"artist":null,"url":null,"cover":null,"lrc":null}]},"mermaid":{"enable":false,"version":"9.3.0"}},"version":"2.8.2","navbar":{"auto_hide":false,"color":{"left":"#f78736","right":"#367df7","transparency":35},"width":{"home":"1200px","pages":"1000px"},"links":{"Home":{"path":"/","icon":"fa-regular fa-house"},"Archives":{"path":"/archives","icon":"fa-regular fa-archive"}},"search":{"enable":true,"preload":true}},"page_templates":{"friends_column":2,"tags_style":"blur"},"home":{"sidebar":{"enable":true,"position":"left","first_item":"menu","announcement":null,"show_on_mobile":true,"links":null},"article_date_format":"auto","excerpt_length":200,"categories":{"enable":true,"limit":3},"tags":{"enable":true,"limit":3}},"footerStart":"2022/8/17 11:45:14"};
    window.lang_ago = {"second":"%s 秒前","minute":"%s 分钟前","hour":"%s 小时前","day":"%s 天前","week":"%s 周前","month":"%s 个月前","year":"%s 年前"};
    window.data = {"masonry":false};
  </script>
    
    <!--- Fontawesome Part-->
    
<link rel="stylesheet" href="/fontawesome/fontawesome.min.css">

    
<link rel="stylesheet" href="/fontawesome/brands.min.css">

    
<link rel="stylesheet" href="/fontawesome/solid.min.css">

    
<link rel="stylesheet" href="/fontawesome/regular.min.css">

    
    
    
    
<meta name="generator" content="Hexo 6.3.0">
<style>.github-emoji { position: relative; display: inline-block; width: 1.2em; min-height: 1.2em; overflow: hidden; vertical-align: top; color: transparent; }  .github-emoji > span { position: relative; z-index: 10; }  .github-emoji img, .github-emoji .fancybox { margin: 0 !important; padding: 0 !important; border: none !important; outline: none !important; text-decoration: none !important; user-select: none !important; cursor: auto !important; }  .github-emoji img { height: 1.2em !important; width: 1.2em !important; position: absolute !important; left: 50% !important; top: 50% !important; transform: translate(-50%, -50%) !important; user-select: none !important; cursor: auto !important; } .github-emoji-fallback { color: inherit; } .github-emoji-fallback img { opacity: 0 !important; }</style>
</head>



<body>
	<div class="progress-bar-container">
	

	
	<span class="pjax-progress-bar"></span>
	<!--        <span class="swup-progress-icon">-->
	<!--            <i class="fa-solid fa-circle-notch fa-spin"></i>-->
	<!--        </span>-->
	
</div>

<main class="page-container" id="swup">

	

	<div class="main-content-container flex flex-col justify-between min-h-dvh">
		<div class="main-content-header">
			<header class="navbar-container px-6 md:px-12">
    <div class="navbar-content transition-navbar ">
        <div class="left">
            
                <a class="logo-image h-8 w-8 sm:w-10 sm:h-10 mr-3" href="/">
                    <img src="/images/rabete.jpg" class="w-full h-full rounded-sm">
                </a>
            
            <a class="logo-title" href="/">
                
                xiaoeryu
                
            </a>
        </div>

        <div class="right">
            <!-- PC -->
            <div class="desktop">
                <ul class="navbar-list">
                    
                        
                            

                            <li class="navbar-item">
                                <!-- Menu -->
                                <a class=""
                                   href="/"
                                        >
                                    <i class="fa-regular fa-house fa-fw"></i>
                                    首页
                                    
                                </a>

                                <!-- Submenu -->
                                
                            </li>
                    
                        
                            

                            <li class="navbar-item">
                                <!-- Menu -->
                                <a class=""
                                   href="/archives"
                                        >
                                    <i class="fa-regular fa-archive fa-fw"></i>
                                    归档
                                    
                                </a>

                                <!-- Submenu -->
                                
                            </li>
                    
                    
                        <li class="navbar-item search search-popup-trigger">
                            <i class="fa-solid fa-magnifying-glass"></i>
                        </li>
                    
                </ul>
            </div>
            <!-- Mobile -->
            <div class="mobile">
                
                    <div class="icon-item search search-popup-trigger"><i class="fa-solid fa-magnifying-glass"></i>
                    </div>
                
                <div class="icon-item navbar-bar">
                    <div class="navbar-bar-middle"></div>
                </div>
            </div>
        </div>
    </div>

    <!-- Mobile sheet -->
    <div class="navbar-drawer h-dvh w-full absolute top-0 left-0 bg-background-color flex flex-col justify-between">
        <ul class="drawer-navbar-list flex flex-col px-4 justify-center items-start">
            
                
                    

                    <li class="drawer-navbar-item text-base my-1.5 flex flex-col w-full">
                        
                        <a class="py-1.5 px-2 flex flex-row items-center justify-between gap-1 hover:!text-primary active:!text-primary text-2xl font-semibold group border-b border-border-color hover:border-primary w-full "
                           href="/"
                        >
                            <span>
                                首页
                            </span>
                            
                                <i class="fa-regular fa-house fa-sm fa-fw"></i>
                            
                        </a>
                        

                        
                    </li>
            
                
                    

                    <li class="drawer-navbar-item text-base my-1.5 flex flex-col w-full">
                        
                        <a class="py-1.5 px-2 flex flex-row items-center justify-between gap-1 hover:!text-primary active:!text-primary text-2xl font-semibold group border-b border-border-color hover:border-primary w-full "
                           href="/archives"
                        >
                            <span>
                                归档
                            </span>
                            
                                <i class="fa-regular fa-archive fa-sm fa-fw"></i>
                            
                        </a>
                        

                        
                    </li>
            

            
            
        </ul>

        <div class="statistics flex justify-around my-2.5">
    <a class="item tag-count-item flex flex-col justify-center items-center w-20" href="/tags">
        <div class="number text-2xl sm:text-xl text-second-text-color font-semibold">92</div>
        <div class="label text-third-text-color text-sm">标签</div>
    </a>
    <a class="item tag-count-item flex flex-col justify-center items-center w-20" href="/categories">
        <div class="number text-2xl sm:text-xl text-second-text-color font-semibold">14</div>
        <div class="label text-third-text-color text-sm">分类</div>
    </a>
    <a class="item tag-count-item flex flex-col justify-center items-center w-20" href="/archives">
        <div class="number text-2xl sm:text-xl text-second-text-color font-semibold">112</div>
        <div class="label text-third-text-color text-sm">文章</div>
    </a>
</div>
    </div>

    <div class="window-mask"></div>

</header>


		</div>

		<div class="main-content-body transition-fade-up">
			

			<div class="main-content">
				<div class="post-page-container flex relative justify-between box-border w-full h-full">
	<div class="article-content-container">

		<div class="article-title relative w-full">
			
			<div class="w-full flex items-center pt-6 justify-start">
				<h1 class="article-title-regular text-second-text-color tracking-tight text-4xl md:text-6xl font-semibold px-2 sm:px-6 md:px-8 py-3">绕过爱奇艺libmsaoaidsec.so的Frida检测</h1>
			</div>
			
		</div>

		
		<div class="article-header flex flex-row gap-2 items-center px-2 sm:px-6 md:px-8">
			<div class="avatar w-[46px] h-[46px] flex-shrink-0 rounded-medium border border-border-color p-[1px]">
				<img src="/images/rabete.jpg">
			</div>
			<div class="info flex flex-col justify-between">
				<div class="author flex items-center">
					<span class="name text-default-text-color text-lg font-semibold">xiaoeryu</span>
					
					<span class="author-label ml-1.5 text-xs px-2 py-0.5 rounded-small text-third-text-color border border-shadow-color-1">Lv5</span>
					
				</div>
				<div class="meta-info">
					<div class="article-meta-info">
    <span class="article-date article-meta-item">
        <i class="fa-regular fa-pen-fancy"></i>&nbsp;
        <span class="desktop">2024-08-09 11:29:58</span>
        <span class="mobile">2024-08-09 11:29:58</span>
        <span class="hover-info">创建</span>
    </span>
    
        <span class="article-date article-meta-item">
            <i class="fa-regular fa-wrench"></i>&nbsp;
            <span class="desktop">2024-08-11 23:42:36</span>
            <span class="mobile">2024-08-11 23:42:36</span>
            <span class="hover-info">更新</span>
        </span>
    

    
        <span class="article-categories article-meta-item">
            <i class="fa-regular fa-folders"></i>&nbsp;
            <ul>
                
                
                    
                        
                        <li>
                            <a href="/categories/Android%E9%80%86%E5%90%91/">Android逆向</a>&nbsp;
                        </li>
                    
                    
                
            </ul>
        </span>
    
    
        <span class="article-tags article-meta-item">
            <i class="fa-regular fa-tags"></i>&nbsp;
            <ul>
                
                    <li>
                        <a href="/tags/App%E9%80%86%E5%90%91/">App逆向</a>&nbsp;
                    </li>
                
                    <li>
                        | <a href="/tags/Frida%E5%8F%8D%E8%B0%83%E8%AF%95/">Frida反调试</a>&nbsp;
                    </li>
                
            </ul>
        </span>
    

    
    
    
    
        <span class="article-pv article-meta-item">
            <i class="fa-regular fa-eye"></i>&nbsp;<span id="busuanzi_value_page_pv"></span>
        </span>
    
</div>

				</div>
			</div>
		</div>
		

		


		<div class="article-content markdown-body px-2 sm:px-6 md:px-8 pb-8">
			<p>本文中所有内容仅供研究与学习使用，请勿用于任何商业用途和非法用途，否则后果自负！</p>
<p>下面主要分析了如何定位Frida检测位置，以及定位后如何绕过的问题。其原理参见之前写的<a href="https://xiaoeeyu.github.io/2024/03/25/libcHook/">libcHook</a></p>
<h2 id="0x00：环境"><a href="#0x00：环境" class="headerlink" title="0x00：环境"></a>0x00：环境</h2><p>设备：Google Pixel 5</p>
<p>系统版本：Android 13</p>
<p>版本号：TQ2A.230405.003.B2</p>
<p>Frida-Server：16.2.1</p>
<p>爱奇艺：15.7.5</p>
<h2 id="0x01：问题"><a href="#0x01：问题" class="headerlink" title="0x01：问题"></a>0x01：问题</h2><p>爱奇艺有反Frida机制，在我们使用Frida启动App的时候进程会被干掉</p>
<img lazyload="" src="/images/loading.svg" data-src="/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807181833519.png" class="" title="image-20240807181833519">

<center>图0</center>

<h2 id="0x02：分析"><a href="#0x02：分析" class="headerlink" title="0x02：分析"></a>0x02：分析</h2><p>Frida检测一般都是在Native层实现的，那么我们首先需要定位检测机制是在哪个so中实现的，这里我们就需要先hook Android的动态链接库加载函数，观察它加载到哪个so的时候会崩溃</p>
<img lazyload="" src="/images/loading.svg" data-src="/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807185049751.png" class="" title="image-20240807185049751">

<center>图1 android_dlopen_ext原型</center>

<p>hook <code>android_dlopen_ext</code>查看so的加载流程</p>
<pre><code class="js">function hook_dlopen() {
    Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
        {
            onEnter: function (args) {
                this.fileName = args[0].readCString()
                console.log(`dlopen onEnter: ${this.fileName}`)
            }, onLeave: function(retval){
                console.log(`dlopen onLeave fileName: ${this.fileName}`)
                if(this.fileName != null &amp;&amp; this.fileName.indexOf("libmsaoaidsec.so") &gt;= 0){
                    let JNI_OnLoad = Module.getExportByName(this.fileName, 'JNI_OnLoad')
                    console.log(`dlopen onLeave JNI_OnLoad: ${JNI_OnLoad}`)
                }
            }
        }
    );
}

setImmediate(hook_dlopen)
</code></pre>
<img lazyload="" src="/images/loading.svg" data-src="/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807214508434.png" class="" title="image-20240807214508434">

<center>图2</center>

<ul>
<li>从打印的log可以看到最后一个加载的so是<code>libmsaoaidsec.so</code>，并且没有调用<code>onLeave</code>，由此可知崩溃点就在<code>libmsaoaidsec.so</code>中，并且是在<code>JNI_OnLoad</code>之前检测的，so在加载之后会先调用<code>.init_proc</code>函数，接着调用<code>.init_array</code>中的函数，最后才是<code>JNI_OnLoad</code>函数，所以根据log可以确定检测点在<code>JNI_OnLoad</code>之前，接下来选择的注入时机可以选择在<code>dlopen</code>加载<code>libmsaoaidsec.so</code>之后</li>
</ul>
<p>需要注意的一点是在<code>dlopen</code>函数调用完成之后<code>.init_xxx</code>已经执行完成了</p>
<img lazyload="" src="/images/loading.svg" data-src="/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807220025518.png" class="" title="image-20240807220025518">

<center>图3 源码截图</center>

<ul>
<li>那么我们就hook这里的<code>call_constructors</code>函数，在onEnter里注入代码</li>
</ul>
<p>在设备中找到<code>call_constructors</code>的offset</p>
<p><code>readelf -sW /apex/com.android.runtime/bin/linker64 | grep call_constructors</code></p>
<img lazyload="" src="/images/loading.svg" data-src="/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807223922777.png" class="" title="image-20240807223922777">

<pre><code class="js">function hook_linker_call_constructors() {
    let linker64_base_addr = Module.getBaseAddress('linker64')
    let offset = 0x4e4dc    // __dl__ZN6soinfo17call_constructorsEv
    let call_constructors = linker64_base_addr.add(offset)
    let listener = Interceptor.attach(call_constructors,{
        onEnter:function(args){
            console.log('hook_linker_call_constructors onEnter')
            let secmodule = Process.findModuleByName("libmsaoaidsec.so")
            if (secmodule != null){
                // do something
            }
        }
    })
}
</code></pre>
<p>确定hook点了之后，接下来定位具体的Frida检测点</p>
<p>对Frida的检测通常会使用openat、open、strstr、pthread_create、snprintf、sprintf、readlinkat等一系列函数</p>
<h4 id="hook-pthread-create-定位检测点"><a href="#hook-pthread-create-定位检测点" class="headerlink" title="hook pthread_create 定位检测点"></a>hook <code>pthread_create</code> 定位检测点</h4><p>我们这里对<code>pthread_create</code>进行hook，打印新线程要执行的函数地址</p>
<pre><code class="js">function hook_pthred_create(){
    console.log("libmsaoaidsec.so --- " + Process.findModuleByName("libmsaoaidsec.so").base)
    Interceptor.attach(Module.findExportByName('libc.so','pthread_create'),{
        onEnter(args){
            let func_addr = args[2]
            console.log(`The thread Called function address is: ${func_addr}`)
        }
    })
}
</code></pre>
<p>执行脚本：<code>frida -U -f com.qiyi.video -l tmp03.js</code></p>
<img lazyload="" src="/images/loading.svg" data-src="/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807230428971.png" class="" title="image-20240807230428971">

<center>图4</center>

<ul>
<li><p>根据打印的结果可以看到有两个线程是libmsaoaidsec.so创建的</p>
<blockquote>
<p>计算对应的偏移:</p>
<p>libmsaoaidsec.so — 0x7a27c43000</p>
<p>The thread Called function address is: 0x7a27c5e8d4		偏移-&gt; 1B8D4<br>The thread Called function address is: 0x7a27c69e5c		偏移-&gt; 26E5C</p>
</blockquote>
</li>
</ul>
<p>既然<strong>libmsaoaidsec.so</strong>创建了两个线程，猜测这其中起码有一个是和Frida检测有关的</p>
<p>用IDA打开libmsaoaidsec.so，查找偏移</p>
<p>查看<code>0x1B8D4</code>地址处对应的函数</p>
<img lazyload="" src="/images/loading.svg" data-src="/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807232702784.png" class="" title="image-20240807232702784">

<center>图5</center>

<img lazyload="" src="/images/loading.svg" data-src="/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807233048464.png" class="" title="image-20240807233048464">

<center>图6</center>

<ul>
<li>使用交叉引用往上查找</li>
</ul>
<p>到了上一层，这里的<code>v26</code>应该就是<code>pthred_create</code>了</p>
<img lazyload="" src="/images/loading.svg" data-src="/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807233934309.png" class="" title="image-20240807233934309">

<img lazyload="" src="/images/loading.svg" data-src="/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807233856368.png" class="" title="image-20240807233856368">

<center>图7</center>

<p>这里绕过的方法很简单，可以选择直接nop掉<code>pthread_create</code>或者替换检测函数的代码逻辑都可以，我们这里选择replace掉<code>sub_1b924</code></p>
<h2 id="0x03：最终代码"><a href="#0x03：最终代码" class="headerlink" title="0x03：最终代码"></a>0x03：最终代码</h2><pre><code class="js">function hook_dlopen() {
    Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
        {
            onEnter: function (args) {
                this.fileName = args[0].readCString()
                console.log(`dlopen onEnter: ${this.fileName}`)
                if (this.fileName !== undefined &amp;&amp; this.fileName.indexOf("libmsaoaidsec.so") &gt;= 0) {
                    hook_linker_call_constructors()
                }
            }, onLeave: function (retval) {
                console.log(`dlopen onLeave fileName: ${this.fileName}`)
                if (this.fileName != null &amp;&amp; this.fileName.indexOf("libmsaoaidsec.so") &gt;= 0) {
                    let JNI_OnLoad = Module.getExportByName(this.fileName, 'JNI_OnLoad')
                    console.log(`dlopen onLeave JNI_OnLoad: ${JNI_OnLoad}`)
                }
            }
        }
    );
}

function hook_linker_call_constructors() {
    let linker64_base_addr = Module.getBaseAddress('linker64')
    let offset = 0x4e4dc    // __dl__ZN6soinfo17call_constructorsEv
    let call_constructors = linker64_base_addr.add(offset)
    let listener = Interceptor.attach(call_constructors,{
        onEnter:function(args){
            console.log('hook_linker_call_constructors onEnter')
            let secmodule = Process.findModuleByName("libmsaoaidsec.so")
            if (secmodule != null){
                // do something
                // hook_pthred_create()
                hook_sub_1b924()
                listener.detach()
            }
        }
    })
}

function hook_pthred_create(){
    console.log("libmsaoaidsec.so --- " + Process.findModuleByName("libmsaoaidsec.so").base)
    Interceptor.attach(Module.findExportByName('libc.so','pthread_create'),{
        onEnter(args){
            let func_addr = args[2]
            console.log(`The thread Called function address is: ${func_addr}`)
        }
    })
}

function hook_sub_1b924() {
    let secmodule = Process.findModuleByName("libmsaoaidsec.so")
    Interceptor.replace(secmodule.base.add(0x1B924), new NativeCallback(function () {
      console.log(`hook_sub_1b924 &gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt;&gt; replace`)
    }, 'void', []));
  }

setImmediate(hook_dlopen)
</code></pre>
<img lazyload="" src="/images/loading.svg" data-src="/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240807235012797.png" class="" title="image-20240807235012797">

<center>图8</center>



<hr>
<h2 id="0x04：另一种定位方法"><a href="#0x04：另一种定位方法" class="headerlink" title="0x04：另一种定位方法"></a>0x04：另一种定位方法</h2><p>通过栈回溯的方式来定位Frida检测点</p>
<p>这里我们的思路是：</p>
<blockquote>
<p>既然挂上Frida就会退出，那么我们就来分析最终是调用了哪个系统调用导致的退出，找到之后再通过栈回溯定位到Frida检测点</p>
<ol>
<li>使用<code>sleep</code>让进程暂停在加载了<code>libmsaoaidsec.so</code>处</li>
<li>使用工具<code>strace</code>监控系统调用</li>
<li>找到系统调用后，通过栈回溯定位检测点</li>
</ol>
</blockquote>
<h3 id="01：定位kill进程调用"><a href="#01：定位kill进程调用" class="headerlink" title="01：定位kill进程调用"></a>01：定位kill进程调用</h3><pre><code class="js">    function hookDlopen() {
        let Func_sleep = new NativeFunction(Module.getExportByName('libc.so', 'sleep'), 'uint', ['uint'])
        let linker64_base_addr = Module.getBaseAddress('linker64')
        let offset = 0x3b6ec // __dl__Z9do_dlopenPKciPK17android_dlextinfoPKv
        let android_dlopen_ext = linker64_base_addr.add(offset)
        Interceptor.attach(android_dlopen_ext, {
            onEnter: function (args) {
                this.name = args[0].readCString()
                console.log(`Current PID: ${Process.id}`)
                console.log(`dlopen onEnter ${this.name}`)
                if (this.name != null &amp;&amp; this.name.indexOf('libmsaoaidsec.so') &gt;= 0) {
                    Func_sleep(10)
                    // hook_mmap()
                }
            }, onLeave: function (retval) {
                console.log(`dlopen onLeave name: ${this.name}`)
            }
        })
    }
</code></pre>
<ul>
<li><p>执行：<code>frida -U -f com.qiyi.video -l tmp01.js</code></p>
<img lazyload="" src="/images/loading.svg" data-src="/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240811173455755.png" class="" title="image-20240811173455755">

<center>图9</center></li>
</ul>
<p>趁着进程暂停在<code>Func_sleep(10)</code>立即去执行：</p>
<p><code>strace -e trace=process -i -f -p 20014</code></p>
<img lazyload="" src="/images/loading.svg" data-src="/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240811180103387.png" class="" title="image-20240811180103387">

<center>图10</center>

<ul>
<li>查看标记出来这一行，显示<code>20060</code>线程是在地址<code>0x00000071bb65b008</code>处调用<code>exit_group</code>退出的</li>
</ul>
<p>通过<code>proc/pid/maps libc</code>查看<code>libc.so</code>的地址范围</p>
<img lazyload="" src="/images/loading.svg" data-src="/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240811181118140.png" class="" title="image-20240811181118140">

<center>图11</center>

<ul>
<li>在一般情况下，<code>exit_group</code>的调用是通过<code>libc.so</code>提供的接口函数调用的，而这里调用<code>exit_group</code>的地址范围不在<code>libc</code>中，说明<code>exit_group</code>没有通过标准库来调用。那么大概率是使用了动态分配的内存区域或者自定义加载的库</li>
</ul>
<h3 id="02：获取kill进程的调用栈"><a href="#02：获取kill进程的调用栈" class="headerlink" title="02：获取kill进程的调用栈"></a>02：获取kill进程的调用栈</h3><p>使用动态调用的话就涉及到内存的动态分配</p>
<p>接下来使用与刚才相同的方法让进程<code>sleep</code>，使用<code>strace</code>来监控与内存相关的系统调用</p>
<p><code>strace -e trace=process,memory -i -f -p pid </code></p>
<img lazyload="" src="/images/loading.svg" data-src="/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240811212738608.png" class="" title="image-20240811212738608">

<center>图12</center>

<ul>
<li>根据这两行可以看出来<code>exit_group</code>的地址来自于<code>mmap</code>申请的28字节空间</li>
</ul>
<p>从<code>mmap</code>的地址<code>0x00000071af666878</code>可以看出来它是<code>libc.so</code>中的函数，那么接下来可以hook <code>mmap</code>方法，打印其调用栈</p>
<pre><code class="js">    function hook_mmap() {
        var mmap_addr = Module.findExportByName("libc.so", "mmap")
        console.log("mmap_addr ==&gt;", mmap_addr)
        Interceptor.attach(mmap_addr, {
            onEnter: function (args) {
                // console.log("args ==&gt; ",)
                var length = args[1].toInt32()
                if (length === 28) {
                    console.log(`mmap length: ${length}`)
                    console.log('backtrace:\n' + Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join("\n") + '\n');

                    console.log("this.context ==&gt; ", JSON.stringify(this.context))  // 有点奇怪，这行代码必须要加上栈回溯才能正常输出。应该是Frida版本的问题

                }
            }
        })
    }
</code></pre>
<img lazyload="" src="/images/loading.svg" data-src="/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240811213558416.png" class="" title="image-20240811213558416">

<center>图13</center>

<ul>
<li>成功的打印出了调用栈</li>
</ul>
<h3 id="03：在IDA中定位检测函数"><a href="#03：在IDA中定位检测函数" class="headerlink" title="03：在IDA中定位检测函数"></a>03：在IDA中定位检测函数</h3><p>用IDA打开<code>libmsaoaidsec.so</code>并跳转到栈回溯位置</p>
<img lazyload="" src="/images/loading.svg" data-src="/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240811214336838.png" class="" title="image-20240811214336838">

<center>图14</center>

<img lazyload="" src="/images/loading.svg" data-src="/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240811214529666.png" class="" title="image-20240811214529666">

<center>图15</center>

<ul>
<li>F5之后粗略看一下代码，确实跟我们之前监控内存调用的执行流程相同</li>
</ul>
<p>那我们就根据交叉引用继续往上回溯找到整个检测逻辑的位置</p>
<img lazyload="" src="/images/loading.svg" data-src="/2024/08/09/%E7%BB%95%E8%BF%87%E7%88%B1%E5%A5%87%E8%89%BAlibmsaoaidsec-so%E7%9A%84Frida%E6%A3%80%E6%B5%8B/image-20240811215233683.png" class="" title="image-20240811215233683">

<center>图16</center>

<ul>
<li>最后定位到了<code>sub_1B924</code>这个函数是整个检测逻辑所在</li>
</ul>
<h3 id="04：CODE"><a href="#04：CODE" class="headerlink" title="04：CODE"></a>04：CODE</h3><p>那么接下来我们还是通过hook <code>call_constructors</code>方法，在加载到<code>libmsaoaidsec.so</code>时替换掉其中偏移<code>0x1B924</code>处的函数</p>
<pre><code class="js">
Java.perform(function () {
    // void* mmap(void* addr, size_t size, int prot, int flags, int fd, off_t offset)
    function hook_mmap() {
        var mmap_addr = Module.findExportByName("libc.so", "mmap")
        console.log("mmap_addr ==&gt;", mmap_addr)
        Interceptor.attach(mmap_addr, {
            onEnter: function (args) {
                // console.log("args ==&gt; ",)
                var length = args[1].toInt32()
                if (length === 28) {
                    console.log(`mmap length: ${length}`)
                    console.log('backtrace:\n' + Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join("\n") + '\n');

                    console.log("this.context ==&gt; ", JSON.stringify(this.context))  // 有点奇怪，这行代码必须要加上栈回溯才能正常输出。应该是Frida版本的问题

                }
            }
        })
    }

    function hook_linker_call_constructors(){
        let linker64_base_addr = Module.findBaseAddress("linker64")
        let offset = 0x510cc    // __dl__ZN6soinfo17call_constructorsEv
        let call_consturctors = linker64_base_addr.add(offset)
        let listener = Interceptor.attach(call_consturctors,{
            onEnter:function(args){
                console.log("hook_linker_call_constructors onEnter")
                let secmodule = Process.findModuleByName("libmsaoaidsec.so")
                if(secmodule != null){
                    hook_sub_1B924(secmodule)
                    listener.detach()
                }
            }
        })
    }

    function hook_sub_1B924(secmodule){
        Interceptor.replace(secmodule.base.add(0x1B924),new NativeCallback(function(){
            console.log("hook_sub_1B924 =====&gt; replace")
        },"void",[]))
    }

    function hookDlopen() {
        let Func_sleep = new NativeFunction(Module.getExportByName('libc.so', 'sleep'), 'uint', ['uint'])
        let linker64_base_addr = Module.getBaseAddress('linker64')
        let offset = 0x3b6ec // __dl__Z9do_dlopenPKciPK17android_dlextinfoPKv
        let android_dlopen_ext = linker64_base_addr.add(offset)
        Interceptor.attach(android_dlopen_ext, {
            onEnter: function (args) {
                this.name = args[0].readCString()
                console.log(`Current PID: ${Process.id}`)
                console.log(`dlopen onEnter ${this.name}`)
                if (this.name != null &amp;&amp; this.name.indexOf('libmsaoaidsec.so') &gt;= 0) {
                    // Func_sleep(10)
                    // hook_mmap()
                    hook_linker_call_constructors()
                }
            }, onLeave: function (retval) {
                console.log(`dlopen onLeave name: ${this.name}`)
            }
        })
    }
    hookDlopen()
})
</code></pre>
<p>后记：</p>
<p>libmsaoaidsec.so这个库用的还挺普遍的，bilibili也使用了相同的检测方式</p>

		</div>

		
		<div class="post-copyright-info w-full my-8 px-2 sm:px-6 md:px-8">
			<div class="article-copyright-info-container">
    <ul>
        <li><strong>标题:</strong> 绕过爱奇艺libmsaoaidsec.so的Frida检测</li>
        <li><strong>作者:</strong> xiaoeryu</li>
        <li><strong>创建于
                :</strong> 2024-08-09 11:29:58</li>
        
            <li>
                <strong>更新于
                    :</strong> 2024-08-11 23:42:36
            </li>
        
        <li>
            <strong>链接:</strong> https://github.com/xiaoeryu/2024/08/09/绕过爱奇艺libmsaoaidsec-so的Frida检测/
        </li>
        <li>
            <strong>
                版权声明:
            </strong>
            

            
                本文章采用 <a class="license" target="_blank" rel="noopener" href="https://creativecommons.org/licenses/by-nc-sa/4.0">CC BY-NC-SA 4.0</a> 进行许可。
            
        </li>
    </ul>
</div>

		</div>
		

		
		<ul class="post-tags-box text-lg mt-1.5 flex-wrap justify-center flex md:hidden">
			
			<li class="tag-item mx-0.5">
				<a href="/tags/App%E9%80%86%E5%90%91/">#App逆向</a>&nbsp;
			</li>
			
			<li class="tag-item mx-0.5">
				<a href="/tags/Frida%E5%8F%8D%E8%B0%83%E8%AF%95/">#Frida反调试</a>&nbsp;
			</li>
			
		</ul>
		

		

		
		<div class="article-nav my-8 flex justify-between items-center px-2 sm:px-6 md:px-8">
			
			<div class="article-prev border-border-color shadow-redefine-flat shadow-shadow-color-2 rounded-medium px-4 py-2 hover:shadow-redefine-flat-hover hover:shadow-shadow-color-2">
				<a class="prev" rel="prev" href="/2024/08/10/%E7%BC%96%E8%AF%91Android13-AOSP/">
					<span class="left arrow-icon flex justify-center items-center">
						<i class="fa-solid fa-chevron-left"></i>
					</span>
					<span class="title flex justify-center items-center">
						<span class="post-nav-title-item">编译Android13-AOSP</span>
						<span class="post-nav-item">上一篇</span>
					</span>
				</a>
			</div>
			
			
			<div class="article-next border-border-color shadow-redefine-flat shadow-shadow-color-2 rounded-medium px-4 py-2 hover:shadow-redefine-flat-hover hover:shadow-shadow-color-2">
				<a class="next" rel="next" href="/2024/08/01/%E6%9F%90%E6%98%93%E6%96%B0%E9%97%BB%E9%80%86%E5%90%91/">
					<span class="title flex justify-center items-center">
						<span class="post-nav-title-item">某易新闻逆向</span>
						<span class="post-nav-item">下一篇</span>
					</span>
					<span class="right arrow-icon flex justify-center items-center">
						<i class="fa-solid fa-chevron-right"></i>
					</span>
				</a>
			</div>
			
		</div>
		


		
		<div class="comment-container px-2 sm:px-6 md:px-8 pb-8">
			<div class="comments-container mt-10 w-full ">
    <div id="comment-anchor" class="w-full h-2.5"></div>
    <div class="comment-area-title w-full my-1.5 md:my-2.5 text-xl md:text-3xl font-bold">
        评论
    </div>
    

        
            


        
    
</div>

		</div>
		
	</div>

	
	<div class="toc-content-container">
		<div class="post-toc-wrap">
	<div class="post-toc">
		<div class="toc-title">目录</div>
		<div class="page-title">绕过爱奇艺libmsaoaidsec.so的Frida检测</div>
		<ol class="nav"><li class="nav-item nav-level-2"><a class="nav-link" href="#0x00%EF%BC%9A%E7%8E%AF%E5%A2%83"><span class="nav-text">0x00：环境</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#0x01%EF%BC%9A%E9%97%AE%E9%A2%98"><span class="nav-text">0x01：问题</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#0x02%EF%BC%9A%E5%88%86%E6%9E%90"><span class="nav-text">0x02：分析</span></a><ol class="nav-child"><li class="nav-item nav-level-4"><a class="nav-link" href="#hook-pthread-create-%E5%AE%9A%E4%BD%8D%E6%A3%80%E6%B5%8B%E7%82%B9"><span class="nav-text">hook pthread_create 定位检测点</span></a></li></ol></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#0x03%EF%BC%9A%E6%9C%80%E7%BB%88%E4%BB%A3%E7%A0%81"><span class="nav-text">0x03：最终代码</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#0x04%EF%BC%9A%E5%8F%A6%E4%B8%80%E7%A7%8D%E5%AE%9A%E4%BD%8D%E6%96%B9%E6%B3%95"><span class="nav-text">0x04：另一种定位方法</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#01%EF%BC%9A%E5%AE%9A%E4%BD%8Dkill%E8%BF%9B%E7%A8%8B%E8%B0%83%E7%94%A8"><span class="nav-text">01：定位kill进程调用</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#02%EF%BC%9A%E8%8E%B7%E5%8F%96kill%E8%BF%9B%E7%A8%8B%E7%9A%84%E8%B0%83%E7%94%A8%E6%A0%88"><span class="nav-text">02：获取kill进程的调用栈</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#03%EF%BC%9A%E5%9C%A8IDA%E4%B8%AD%E5%AE%9A%E4%BD%8D%E6%A3%80%E6%B5%8B%E5%87%BD%E6%95%B0"><span class="nav-text">03：在IDA中定位检测函数</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#04%EF%BC%9ACODE"><span class="nav-text">04：CODE</span></a></li></ol></li></ol>

	</div>
</div>
	</div>
	
</div>
			</div>

			
		</div>

		<div class="main-content-footer">
			<footer class="footer mt-5 py-5 h-auto text-base text-third-text-color relative border-t-2 border-t-border-color">
    <div class="info-container py-3 text-center">
        
        <div class="text-center">
            &copy;
            
              <span>2022</span>
              -
            
            2025&nbsp;&nbsp;<i class="fa-solid fa-heart fa-beat" style="--fa-animation-duration: 0.5s; color: #f54545"></i>&nbsp;&nbsp;<a href="/">xiaoeryu</a>
            
                
                <p class="post-count space-x-0.5">
                    <span>
                        共撰写了 112 篇文章
                    </span>
                    
                </p>
            
        </div>
        
            <script data-swup-reload-script src="https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script>
            <div class="relative text-center lg:absolute lg:right-[20px] lg:top-1/2 lg:-translate-y-1/2 lg:text-right">
                
                    <span id="busuanzi_container_site_uv" class="lg:!block">
                        <span class="text-sm">访问人数</span>
                        <span id="busuanzi_value_site_uv"></span>
                    </span>
                
                
                    <span id="busuanzi_container_site_pv" class="lg:!block">
                        <span class="text-sm">总访问量</span>
                        <span id="busuanzi_value_site_pv"></span>
                    </span>
                
            </div>
        
        <div class="relative text-center lg:absolute lg:left-[20px] lg:top-1/2 lg:-translate-y-1/2 lg:text-left">
            <span class="lg:block text-sm">由 <?xml version="1.0" encoding="utf-8"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg class="relative top-[2px] inline-block align-baseline" version="1.1" id="圖層_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="1rem" height="1rem" viewBox="0 0 512 512" enable-background="new 0 0 512 512" xml:space="preserve"><path fill="#0E83CD" d="M256.4,25.8l-200,115.5L56,371.5l199.6,114.7l200-115.5l0.4-230.2L256.4,25.8z M349,354.6l-18.4,10.7l-18.6-11V275H200v79.6l-18.4,10.7l-18.6-11v-197l18.5-10.6l18.5,10.8V237h112v-79.6l18.5-10.6l18.5,10.8V354.6z"/></svg><a target="_blank" class="text-base" href="https://hexo.io">Hexo</a> 驱动</span>
            <span class="text-sm lg:block">主题&nbsp;<a class="text-base" target="_blank" href="https://github.com/EvanNotFound/hexo-theme-redefine">Redefine v2.8.2</a></span>
        </div>
        
        
            <div>
                博客已运行 <span class="odometer" id="runtime_days" ></span> 天 <span class="odometer" id="runtime_hours"></span> 小时 <span class="odometer" id="runtime_minutes"></span> 分钟 <span class="odometer" id="runtime_seconds"></span> 秒
            </div>
        
        
            <script data-swup-reload-script>
                try {
                    function odometer_init() {
                    const elements = document.querySelectorAll('.odometer');
                    elements.forEach(el => {
                        new Odometer({
                            el,
                            format: '( ddd).dd',
                            duration: 200
                        });
                    });
                    }
                    odometer_init();
                } catch (error) {}
            </script>
        
        
        
    </div>  
</footer>
		</div>
	</div>

	
	<div class="post-tools">
		<div class="post-tools-container">
	<ul class="article-tools-list">
		<!-- TOC aside toggle -->
		
		<li class="right-bottom-tools page-aside-toggle">
			<i class="fa-regular fa-outdent"></i>
		</li>
		

		<!-- go comment -->
		
		<li class="go-comment">
			<i class="fa-regular fa-comments"></i>
		</li>
		
	</ul>
</div>
	</div>
	

	<div class="right-side-tools-container">
		<div class="side-tools-container">
	<ul class="hidden-tools-list">
		<li class="right-bottom-tools tool-font-adjust-plus flex justify-center items-center">
			<i class="fa-regular fa-magnifying-glass-plus"></i>
		</li>

		<li class="right-bottom-tools tool-font-adjust-minus flex justify-center items-center">
			<i class="fa-regular fa-magnifying-glass-minus"></i>
		</li>

		<li class="right-bottom-tools tool-dark-light-toggle flex justify-center items-center">
			<i class="fa-regular fa-moon"></i>
		</li>

		<!-- rss -->
		

		

		<li class="right-bottom-tools tool-scroll-to-bottom flex justify-center items-center">
			<i class="fa-regular fa-arrow-down"></i>
		</li>
	</ul>

	<ul class="visible-tools-list">
		<li class="right-bottom-tools toggle-tools-list flex justify-center items-center">
			<i class="fa-regular fa-cog fa-spin"></i>
		</li>
		
		<li class="right-bottom-tools tool-scroll-to-top flex justify-center items-center">
			<i class="arrow-up fas fa-arrow-up"></i>
			<span class="percent"></span>
		</li>
		
		
	</ul>
</div>
	</div>

	<div class="image-viewer-container">
	<img src="">
</div>

	
	<div class="search-pop-overlay">
	<div class="popup search-popup">
		<div class="search-header">
			<span class="search-input-field-pre">
				<i class="fa-solid fa-keyboard"></i>
			</span>
			<div class="search-input-container">
				<input autocomplete="off" autocorrect="off" autocapitalize="off" placeholder="站内搜索您需要的内容..." spellcheck="false" type="search" class="search-input">
			</div>
			<span class="popup-btn-close">
				<i class="fa-solid fa-times"></i>
			</span>
		</div>
		<div id="search-result">
			<div id="no-result">
				<i class="fa-solid fa-spinner fa-spin-pulse fa-5x fa-fw"></i>
			</div>
		</div>
	</div>
</div>
	

</main>



<script src="/js/build/libs/Swup.min.js"></script>

<script src="/js/build/libs/SwupSlideTheme.min.js"></script>

<script src="/js/build/libs/SwupScriptsPlugin.min.js"></script>

<script src="/js/build/libs/SwupProgressPlugin.min.js"></script>

<script src="/js/build/libs/SwupScrollPlugin.min.js"></script>

<script src="/js/build/libs/SwupPreloadPlugin.min.js"></script>

<script>
    const swup = new Swup({
        plugins: [
            new SwupScriptsPlugin({
                optin: true,
            }),
            new SwupProgressPlugin(),
            new SwupScrollPlugin({
                offset: 80,
            }),
            new SwupSlideTheme({
                mainElement: ".main-content-body",
            }),
            new SwupPreloadPlugin(),
        ],
        containers: ["#swup"],
    });
</script>




	
<script src="/js/build/tools/imageViewer.js" type="module"></script>

<script src="/js/build/utils.js" type="module"></script>

<script src="/js/build/main.js" type="module"></script>

<script src="/js/build/layouts/navbarShrink.js" type="module"></script>

<script src="/js/build/tools/scrollTopBottom.js" type="module"></script>

<script src="/js/build/tools/lightDarkSwitch.js" type="module"></script>

<script src="/js/build/layouts/categoryList.js" type="module"></script>



    
<script src="/js/build/tools/localSearch.js" type="module"></script>




    
<script src="/js/build/tools/codeBlock.js" type="module"></script>




    
<script src="/js/build/layouts/lazyload.js" type="module"></script>




    
<script src="/js/build/tools/runtime.js"></script>

    
<script src="/js/build/libs/odometer.min.js"></script>

    
<link rel="stylesheet" href="/assets/odometer-theme-minimal.css">




  
<script src="/js/build/libs/Typed.min.js"></script>

  
<script src="/js/build/plugins/typed.js" type="module"></script>








    
<script src="/js/build/libs/anime.min.js"></script>





    
<script src="/js/build/tools/tocToggle.js" type="module" data-swup-reload-script=""></script>

<script src="/js/build/layouts/toc.js" type="module" data-swup-reload-script=""></script>

<script src="/js/build/plugins/tabs.js" type="module" data-swup-reload-script=""></script>




<script src="/js/build/libs/moment-with-locales.min.js" data-swup-reload-script=""></script>


<script src="/js/build/layouts/essays.js" type="module" data-swup-reload-script=""></script>





	
</body>

</html>